List available secret references for the signed-in user.
List available secret references for the signed-in user. Results include metadata such as names, credential ids (for accessGrant), descriptions, allowed hosts, allowed packages, and package_id for package-scoped secrets — never plaintext values. Explicit listing includes caller-owned package-scoped metadata from execute (no package runtime); using a package secret still requires package context. From a package runtime, self-authored and adopted packages see user secrets they can already read; unadopted community forks see only explicitly granted user secrets. Listing a secret does not approve a host: outbound fetch still resolves {{secret:name}} (optionally {{secret:name|scope=user}}) only for approved hosts. Use kody.secretList({ scope }) inside execute-time code for the same metadata. Use /connect/secret-set for user-provided API key, token, and credential entry or rotation.
Org permission: secret:use.
Request
- Base URL: https://api.kody.codes
- URL: https://api.kody.codes/v1/secrets
- Auth: HTTP bearer
Query parameters
Optional scope filter. When omitted, list all accessible scopes. Package-scoped metadata is included for caller-owned secrets (with package_id) even without a package runtime; session secrets stay session-bound. Using a package secret still requires package context.
Response
Success.
Changes
No recorded changes to this operation across all 2 revisions of this API.